feat(api): expose security evaluation results

[abutbul]

• Add security field to skill version API responses
• Map llmAnalysis database field to public API format
• Display security info in CLI inspect command
• Enable security tools like clawsec-clawhub-checker to access internal security checks

Security field includes:

• status: clean|suspicious|malicious|pending|error
• hasWarnings: boolean
• checkedAt: timestamp
• model: evaluation model name

Backward compatible: optional field, no breaking changes.

Greptile Summary

This PR adds a security field to the skill version API response by mapping the internal llmAnalysis database field to a public-facing format. It also displays the security status in the CLI inspect command and adds a SecurityStatusSchema to the shared schema package.

• hasWarnings can be undefined: When verdict is 'benign' and dimensions is absent (both are optional in the DB schema), the hasWarnings expression evaluates to undefined instead of boolean, which will fail SecurityStatusSchema validation on the client side.
• checkedAt uses || instead of ??: The || operator treats 0 as falsy, which would incorrectly map a checkedAt value of 0 to null.
• The schema addition (SecurityStatusSchema) and CLI display logic look correct and are backward compatible.

Confidence Score: 3/5

• The hasWarnings bug will cause client-side schema validation failures for versions with a benign verdict and no dimensions, which is a common case.
• Score of 3 reflects that the feature is a reasonable, backward-compatible addition, but the hasWarnings expression has a concrete bug that will produce undefined instead of boolean in a common code path (benign verdict without dimensions). The checkedAt issue is lower risk but still incorrect.
• convex/httpApiV1/skillsV1.ts — the hasWarnings and checkedAt mapping logic needs fixes before merge.

_{Last reviewed commit: 809cc4f}

_{(2/5) Greptile learns from your feedback when you react with thumbs up/down!}

Context used:

• Context from dashboard - AGENTS.md (source)

[vercel]

@abutbul is attempting to deploy a commit to the Amantus Machina Team on Vercel.

A member of the Team first needs to authorize it.

[greptile-apps]

_{3 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

[abutbul]

Hey this will allow skills to double check before downloading a potentially malicious skill.
please let me know if there are any issues, or changes I can make to enable this security feature.